On 03.12.19 11:47, David Hildenbrand wrote: > On 01.12.19 02:53, akpm@xxxxxxxxxxxxxxxxxxxx wrote: >> From: Steven Price <steven.price@xxxxxxx> >> Subject: mm: add generic ptdump >> >> Add a generic version of page table dumping that architectures can opt-in >> to >> >> [steven.price@xxxxxxx: v15] >> Link: http://lkml.kernel.org/r/20191101140942.51554-20-steven.price@xxxxxxx >> [cai@xxxxxx: fix a -Wold-style-declaration warning] >> Link: http://lkml.kernel.org/r/1572895385-29194-1-git-send-email-cai@xxxxxx >> Link: http://lkml.kernel.org/r/20191028135910.33253-20-steven.price@xxxxxxx >> Signed-off-by: Steven Price <steven.price@xxxxxxx> >> Signed-off-by: Qian Cai <cai@xxxxxx> >> Cc: Albert Ou <aou@xxxxxxxxxxxxxxxxx> >> Cc: Alexander Potapenko <glider@xxxxxxxxxx> >> Cc: Alexandre Ghiti <alex@xxxxxxxx> >> Cc: Andrey Ryabinin <aryabinin@xxxxxxxxxxxxx> >> Cc: Andy Lutomirski <luto@xxxxxxxxxx> >> Cc: Ard Biesheuvel <ard.biesheuvel@xxxxxxxxxx> >> Cc: Arnd Bergmann <arnd@xxxxxxxx> >> Cc: Benjamin Herrenschmidt <benh@xxxxxxxxxxxxxxxxxxx> >> Cc: Borislav Petkov <bp@xxxxxxxxx> >> Cc: Catalin Marinas <catalin.marinas@xxxxxxx> >> Cc: Christian Borntraeger <borntraeger@xxxxxxxxxx> >> Cc: Dave Hansen <dave.hansen@xxxxxxxxxxxxxxx> >> Cc: Dave Jiang <dave.jiang@xxxxxxxxx> >> Cc: David S. Miller <davem@xxxxxxxxxxxxx> >> Cc: Dmitry Vyukov <dvyukov@xxxxxxxxxx> >> Cc: Heiko Carstens <heiko.carstens@xxxxxxxxxx> >> Cc: "H. Peter Anvin" <hpa@xxxxxxxxx> >> Cc: Ingo Molnar <mingo@xxxxxxx> >> Cc: James Hogan <jhogan@xxxxxxxxxx> >> Cc: James Morse <james.morse@xxxxxxx> >> Cc: "Liang, Kan" <kan.liang@xxxxxxxxxxxxxxx> >> Cc: Mark Rutland <mark.rutland@xxxxxxx> >> Cc: Matthew Wilcox <mawilcox@xxxxxxxxxxxxx> >> Cc: Michael Ellerman <mpe@xxxxxxxxxxxxxx> >> Cc: Naoya Horiguchi <n-horiguchi@xxxxxxxxxxxxx> >> Cc: Palmer Dabbelt <palmer@xxxxxxxxxx> >> Cc: Paul Burton <paul.burton@xxxxxxxx> >> Cc: Paul Mackerras <paulus@xxxxxxxxx> >> Cc: Paul Walmsley <paul.walmsley@xxxxxxxxxx> >> Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx> >> Cc: Ralf Baechle <ralf@xxxxxxxxxxxxxx> >> Cc: Russell King <linux@xxxxxxxxxxxxxxx> >> Cc: Shiraz Hashim <shashim@xxxxxxxxxxxxxx> >> Cc: Thomas Gleixner <tglx@xxxxxxxxxxxxx> >> Cc: Vasily Gorbik <gor@xxxxxxxxxxxxx> >> Cc: Vineet Gupta <vgupta@xxxxxxxxxxxx> >> Cc: Will Deacon <will@xxxxxxxxxx> >> Cc: Zong Li <zong.li@xxxxxxxxxx> >> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> >> --- >> >> include/linux/ptdump.h | 21 +++++ >> mm/Kconfig.debug | 21 +++++ >> mm/Makefile | 1 >> mm/ptdump.c | 151 +++++++++++++++++++++++++++++++++++++++ >> 4 files changed, 194 insertions(+) >> >> --- /dev/null >> +++ a/include/linux/ptdump.h >> @@ -0,0 +1,21 @@ >> +/* SPDX-License-Identifier: GPL-2.0 */ >> + >> +#ifndef _LINUX_PTDUMP_H >> +#define _LINUX_PTDUMP_H >> + >> +#include <linux/mm_types.h> >> + >> +struct ptdump_range { >> + unsigned long start; >> + unsigned long end; >> +}; >> + >> +struct ptdump_state { >> + void (*note_page)(struct ptdump_state *st, unsigned long addr, >> + int level, unsigned long val); >> + const struct ptdump_range *range; >> +}; >> + >> +void ptdump_walk_pgd(struct ptdump_state *st, struct mm_struct *mm); >> + >> +#endif /* _LINUX_PTDUMP_H */ >> --- a/mm/Kconfig.debug~mm-add-generic-ptdump >> +++ a/mm/Kconfig.debug >> @@ -117,3 +117,24 @@ config DEBUG_RODATA_TEST >> depends on STRICT_KERNEL_RWX >> ---help--- >> This option enables a testcase for the setting rodata read-only. >> + >> +config GENERIC_PTDUMP >> + bool >> + >> +config PTDUMP_CORE >> + bool >> + >> +config PTDUMP_DEBUGFS >> + bool "Export kernel pagetable layout to userspace via debugfs" >> + depends on DEBUG_KERNEL >> + depends on DEBUG_FS >> + depends on GENERIC_PTDUMP >> + select PTDUMP_CORE >> + help >> + Say Y here if you want to show the kernel pagetable layout in a >> + debugfs file. This information is only useful for kernel developers >> + who are working in architecture specific areas of the kernel. >> + It is probably not a good idea to enable this feature in a production >> + kernel. >> + >> + If in doubt, say N. >> --- a/mm/Makefile~mm-add-generic-ptdump >> +++ a/mm/Makefile >> @@ -98,6 +98,7 @@ obj-$(CONFIG_CMA) += cma.o >> obj-$(CONFIG_MEMORY_BALLOON) += balloon_compaction.o >> obj-$(CONFIG_PAGE_EXTENSION) += page_ext.o >> obj-$(CONFIG_CMA_DEBUGFS) += cma_debug.o >> +obj-$(CONFIG_PTDUMP_CORE) += ptdump.o >> obj-$(CONFIG_USERFAULTFD) += userfaultfd.o >> obj-$(CONFIG_IDLE_PAGE_TRACKING) += page_idle.o >> obj-$(CONFIG_FRAME_VECTOR) += frame_vector.o >> --- /dev/null >> +++ a/mm/ptdump.c >> @@ -0,0 +1,151 @@ >> +// SPDX-License-Identifier: GPL-2.0 >> + >> +#include <linux/pagewalk.h> >> +#include <linux/ptdump.h> >> +#include <linux/kasan.h> >> + >> +static int ptdump_pgd_entry(pgd_t *pgd, unsigned long addr, >> + unsigned long next, struct mm_walk *walk) >> +{ >> + struct ptdump_state *st = walk->private; >> + pgd_t val = READ_ONCE(*pgd); >> + >> + if (pgd_leaf(val)) >> + st->note_page(st, addr, 1, pgd_val(val)); >> + >> + return 0; >> +} >> + >> +static int ptdump_p4d_entry(p4d_t *p4d, unsigned long addr, >> + unsigned long next, struct mm_walk *walk) >> +{ >> + struct ptdump_state *st = walk->private; >> + p4d_t val = READ_ONCE(*p4d); >> + >> + if (p4d_leaf(val)) >> + st->note_page(st, addr, 2, p4d_val(val)); >> + >> + return 0; >> +} >> + >> +static int ptdump_pud_entry(pud_t *pud, unsigned long addr, >> + unsigned long next, struct mm_walk *walk) >> +{ >> + struct ptdump_state *st = walk->private; >> + pud_t val = READ_ONCE(*pud); >> + >> + if (pud_leaf(val)) >> + st->note_page(st, addr, 3, pud_val(val)); >> + >> + return 0; >> +} >> + >> +static int ptdump_pmd_entry(pmd_t *pmd, unsigned long addr, >> + unsigned long next, struct mm_walk *walk) >> +{ >> + struct ptdump_state *st = walk->private; >> + pmd_t val = READ_ONCE(*pmd); >> + >> + if (pmd_leaf(val)) >> + st->note_page(st, addr, 4, pmd_val(val)); >> + >> + return 0; >> +} >> + >> +static int ptdump_pte_entry(pte_t *pte, unsigned long addr, >> + unsigned long next, struct mm_walk *walk) >> +{ >> + struct ptdump_state *st = walk->private; >> + >> + st->note_page(st, addr, 5, pte_val(READ_ONCE(*pte))); >> + >> + return 0; >> +} >> + >> +#ifdef CONFIG_KASAN >> +/* >> + * This is an optimization for KASAN=y case. Since all kasan page tables >> + * eventually point to the kasan_early_shadow_page we could call note_page() >> + * right away without walking through lower level page tables. This saves >> + * us dozens of seconds (minutes for 5-level config) while checking for >> + * W+X mapping or reading kernel_page_tables debugfs file. >> + */ >> +static inline int note_kasan_page_table(struct mm_walk *walk, >> + unsigned long addr) >> +{ >> + struct ptdump_state *st = walk->private; >> + >> + st->note_page(st, addr, 5, pte_val(kasan_early_shadow_pte[0])); >> + return 1; >> +} >> + >> +static int ptdump_test_p4d(unsigned long addr, unsigned long next, >> + p4d_t *p4d, struct mm_walk *walk) >> +{ >> +#if CONFIG_PGTABLE_LEVELS > 4 >> + if (p4d == lm_alias(kasan_early_shadow_p4d)) >> + return note_kasan_page_table(walk, addr); >> +#endif >> + return 0; >> +} >> + >> +static int ptdump_test_pud(unsigned long addr, unsigned long next, >> + pud_t *pud, struct mm_walk *walk) >> +{ >> +#if CONFIG_PGTABLE_LEVELS > 3 >> + if (pud == lm_alias(kasan_early_shadow_pud)) >> + return note_kasan_page_table(walk, addr); >> +#endif >> + return 0; >> +} >> + >> +static int ptdump_test_pmd(unsigned long addr, unsigned long next, >> + pmd_t *pmd, struct mm_walk *walk) >> +{ >> +#if CONFIG_PGTABLE_LEVELS > 2 >> + if (pmd == lm_alias(kasan_early_shadow_pmd)) >> + return note_kasan_page_table(walk, addr); >> +#endif >> + return 0; >> +} >> +#endif /* CONFIG_KASAN */ >> + >> +static int ptdump_hole(unsigned long addr, unsigned long next, >> + int depth, struct mm_walk *walk) >> +{ >> + struct ptdump_state *st = walk->private; >> + >> + st->note_page(st, addr, depth + 1, 0); >> + >> + return 0; >> +} >> + >> +static const struct mm_walk_ops ptdump_ops = { >> + .pgd_entry = ptdump_pgd_entry, >> + .p4d_entry = ptdump_p4d_entry, >> + .pud_entry = ptdump_pud_entry, >> + .pmd_entry = ptdump_pmd_entry, >> + .pte_entry = ptdump_pte_entry, >> +#ifdef CONFIG_KASAN >> + .test_p4d = ptdump_test_p4d, >> + .test_pud = ptdump_test_pud, >> + .test_pmd = ptdump_test_pmd, >> +#endif >> + .pte_hole = ptdump_hole, >> +}; >> + >> +void ptdump_walk_pgd(struct ptdump_state *st, struct mm_struct *mm) >> +{ >> + const struct ptdump_range *range = st->range; >> + >> + down_read(&mm->mmap_sem); >> + while (range->start != range->end) { >> + walk_page_range_novma(mm, range->start, range->end, >> + &ptdump_ops, st); >> + range++; >> + } >> + up_read(&mm->mmap_sem); >> + >> + /* Flush out the last page */ >> + st->note_page(st, 0, 0, 0); >> +} >> _ >> > > On linux-next, booting a simple QEMU x86-64 guest (since I updated from > pre-v5.4 base), I get: > > [ 1.231285] BUG: kernel NULL pointer dereference, address: 0000000000000018 > [ 1.231897] #PF: supervisor read access in kernel mode > [ 1.232354] #PF: error_code(0x0000) - not-present page > [ 1.232803] PGD 0 P4D 0 > [ 1.233033] Oops: 0000 [#1] SMP NOPTI > [ 1.233359] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 5.4.0-next-20191203+ #29 > [ 1.233998] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu4 > [ 1.235015] RIP: 0010:__lock_acquire+0x778/0x1940 > [ 1.235428] Code: 00 45 31 ff 48 8b 44 24 48 65 48 33 04 25 28 00 00 00 0f 85 fd 0d 00 00 48 83 c4 50 44 89 f8 5b7 > [ 1.237051] RSP: 0018:ffffbc6100637c48 EFLAGS: 00010002 > [ 1.237512] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 > [ 1.238147] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000018 > [ 1.238765] RBP: ffff92dd7db54d80 R08: 0000000000000001 R09: 0000000000000000 > [ 1.239395] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 > [ 1.240012] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 > [ 1.240626] FS: 0000000000000000(0000) GS:ffff92dd7dd00000(0000) knlGS:0000000000000000 > [ 1.241316] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 1.241808] CR2: 0000000000000018 CR3: 00000000a8610000 CR4: 00000000000006e0 > [ 1.242407] Call Trace: > [ 1.242626] ? check_usage_backwards+0x99/0x140 > [ 1.243023] ? stack_trace_save+0x4b/0x70 > [ 1.243385] lock_acquire+0xa2/0x1b0 > [ 1.243707] ? __walk_page_range+0x6e5/0xa00 > [ 1.244104] _raw_spin_lock+0x2c/0x40 > [ 1.244431] ? __walk_page_range+0x6e5/0xa00 > [ 1.244817] __walk_page_range+0x6e5/0xa00 > [ 1.245184] walk_page_range_novma+0x69/0xb0 > [ 1.245562] ptdump_walk_pgd+0x46/0x80 > [ 1.245904] ptdump_walk_pgd_level_core+0xb7/0xe0 > [ 1.246318] ? ptdump_walk_pgd_level_core+0xe0/0xe0 > [ 1.246748] ? rest_init+0x23a/0x23a > [ 1.247076] ? rest_init+0x23a/0x23a > [ 1.247392] kernel_init+0x2c/0x106 > [ 1.247700] ret_from_fork+0x27/0x50 > [ 1.248025] Modules linked in: > [ 1.248298] CR2: 0000000000000018 > [ 1.248594] ---[ end trace d9ad45dca0b4f3a3 ]--- > [ 1.249020] RIP: 0010:__lock_acquire+0x778/0x1940 > [ 1.249432] Code: 00 45 31 ff 48 8b 44 24 48 65 48 33 04 25 28 00 00 00 0f 85 fd 0d 00 00 48 83 c4 50 44 89 f8 5b7 > [ 1.251059] RSP: 0018:ffffbc6100637c48 EFLAGS: 00010002 > [ 1.251514] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 > [ 1.252153] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000018 > [ 1.252773] RBP: ffff92dd7db54d80 R08: 0000000000000001 R09: 0000000000000000 > [ 1.253396] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 > [ 1.254026] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 > [ 1.254648] FS: 0000000000000000(0000) GS:ffff92dd7dd00000(0000) knlGS:0000000000000000 > [ 1.255360] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 1.255867] CR2: 0000000000000018 CR3: 00000000a8610000 CR4: 00000000000006e0 > [ 1.256491] BUG: sleeping function called from invalid context at include/linux/percpu-rwsem.h:38 > [ 1.257268] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1, name: swapper/0 > [ 1.257952] INFO: lockdep is turned off. > [ 1.258299] irq event stamp: 1570043 > [ 1.258617] hardirqs last enabled at (1570043): [<ffffffff9716dd2c>] console_unlock+0x45c/0x5c0 > [ 1.259386] hardirqs last disabled at (1570042): [<ffffffff9716d964>] console_unlock+0x94/0x5c0 > [ 1.260153] softirqs last enabled at (1570040): [<ffffffff97e0035d>] __do_softirq+0x35d/0x45d > [ 1.260898] softirqs last disabled at (1570033): [<ffffffff970efe54>] irq_exit+0xf4/0x100 > [ 1.261615] CPU: 3 PID: 1 Comm: swapper/0 Tainted: G D 5.4.0-next-20191203+ #29 > [ 1.262370] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu4 > [ 1.263372] Call Trace: > [ 1.263595] dump_stack+0x8f/0xd0 > [ 1.263895] ___might_sleep.cold+0xb3/0xc3 > [ 1.264246] exit_signals+0x30/0x2d0 > [ 1.264552] do_exit+0xb4/0xc40 > [ 1.264832] rewind_stack_do_exit+0x17/0x20 > [ 1.265198] note: swapper/0[1] exited with preempt_count 1 > [ 1.265700] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009 > [ 1.266443] Kernel Offset: 0x16000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbff) > [ 1.267394] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009 ]--- > > Related to this? > I just made sure that I am actually on the latest linux-next. I do have commit d3634da666853cdff2258a49dd3ce3607c0fd6c5 Author: Steven Price <steven.price@xxxxxxx> Date: Tue Nov 19 11:47:24 2019 +1100 mm-pagewalk-allow-walking-without-vma-fix fix boot crash Reported-by: Qian Cai <cai@xxxxxx> Cc: Stephen Rothwell <sfr@xxxxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> Signed-off-by: Stephen Rothwell <sfr@xxxxxxxxxxxxxxxx> Problem persists. I do have a bunch of debug options enabled in my config and can share if required. -- Thanks, David / dhildenb
